AudioHijack: Imperceptible Audio Attacks Hijack AI Voice Models with Up to 96% Success Rate

AudioHijack presented at IEEE Symposium on Security and Privacy by Zhejiang University team

Lead author Meng Chen, a PhD student at Zhejiang University, developed AudioHijack for presentation at the IEEE Symposium on Security and Privacy in San Francisco — a top-tier peer-reviewed security venue, lending the research significant credibility.

79–96% success rate across 13 models including commercial services from Microsoft and Mistral

The attack was validated against 13 leading open and commercial audio-language models. Demonstrated malicious outcomes include sensitive web searches, downloading files from attacker-controlled servers, and sending emails containing user data — all real agentic capabilities that modern LALMs can perform.

Iterative waveform optimization embeds imperceptible malicious commands in audio files

The algorithm repeatedly adjusts a digital audio clip's numerical waveform values — changes inaudible to humans — while measuring the model's response and refining until the model executes the desired malicious action. This is a well-established adversarial example approach now extended to generative audio models.

Context-agnostic: 30 minutes of training produces a reusable attack signal effective indefinitely

Once trained, the malicious signal works against the target model regardless of user instructions. This dramatically lowers the barrier to sustained attacks — a single 30-minute investment creates a reusable weapon deployable across all future user sessions with the targeted model.

Attacker controls only audio data — not user instructions — enabling passive third-party attacks

Prior generative model attacks required attacker-as-user access (controlling both the audio input and system prompt). AudioHijack breaks this constraint: by manipulating only the audio being processed, attackers can hijack a model during an active session belonging to a completely different user.

Attack vectors span YouTube videos, music, voice notes, Zoom calls, and live voice chats

Any audio a user queries an AI model about is a potential attack surface. Embedding malicious audio in widely distributed content (YouTube, music) or live Zoom meeting recordings sent to transcription services creates scalable passive attack channels. Unpublished follow-on research demonstrates real-time injection into live AI voice chats.

Structural flaw: LALMs cannot separate legitimate user audio from attacker-injected instructions

The core vulnerability mirrors prompt injection in text LLMs — models accept instructions in the same medium as content, making separation impossible. As voice AI gains agentic capabilities (web access, email, file downloads), this attack surface will grow and is harder to filter than text-based attacks because malicious signals are imperceptible to human review.